Run the iptables-restore < backupfile command to incorporate your old firewall rules into the new firewall rules file.

Improve privacy by encrypting more of the protocol. Include strong security analysis in the design. Remove unused and unsafe features of TLS 1.2.

Run the / usr/local/cpanel/scripts/configure_firewall_for_cpanel script. As a cPanel User, I would like to add support for TLS 1.3 to both the Apache and cpsrvd, because TLS 1.3 includes numerous changes that improve security and performance.Run the iptables-save > backupfile command to save your existing firewall rules.Run the systemctl enable firewalld command to start the firewalld service when the server starts.Run the systemctl start rvice command to start the firewalld service.Run the yum install firewalld command to ensure that your system has firewalld installed.SSLProtocol -All +TLSv1 +TLSv1.1 +TLSv1.2. To replace your existing iptables rules with the rules in the /etc/firewalld/services/cpanel.xml file, perform the following steps: How to Disable SSLv3 for Apache and Protect Your WHM/cPanel Server from POODLE. This allows TCP access for the server's ports. If you use custom rules for your firewall, export those rules before you run the script and then re-add them afterward.ĬPanel & WHM version 11.50 and later also includes the cpanel service, which manages all of the rules in the /etc/firewalld/services/cpanel.xml file. The most important of these features is TLS v1.2 support, because TLS v1.0 is veritably insecure. This feature request isn't about bug/security fixes, it's about using a newer version of OpenSSL in order to enable features that are not available in older versions. SSLProtocol -SSLv2 -SSLv3 +TLSv1.2 +TLSv1.The /usr/local/cpanel/scripts/configure_firewall_for_cpanel script clears all existing entries from the iptables application. It may be four years old, but the library itself has been patched and is secure.

Once completed you now have TLS 1.2 that will survive upgrades!įor forwarding secrecy and high encryption ratings add the following from WHM > Apache Configuration > Include Editor > Pre VirtualHost Include, choose either all versions or your current version and paste the below code into the box Go into WHM goto EasyApache, Select build from current profile or customise as you require.

Now we need to configure EasyApache to use what we’ve done, we will do this by creating two files.Įdit all_php5 in your favourite text editorĮdit Apache2_4 in your favourite text editor configure -prefix=/opt/curlssl -with-ssl=/usr/local/ssl -enable-http -enable-ftp LDFLAGS=-L/usr/local/ssl/lib CPPFLAGS=-I/usr/local/ssl/include In order to support the TLS1.1 and TLS1.2 you can follow the steps below to force the use of the newer version of openssl:įirst we need to get the latest openssl version (all links provided in this article are the latest at the time of writing) This is because TLS1.0 will be the only supported method. Since the Poodle vulnerability (SSLv3) a number of clients disabling SSLv3 on CentOS 5 breaks compatibility with external sites and applications such as WHMCS and PayPal IPN.

Cpanel whm how to enable tls v1.2